CVE-2013-1843
medium
CVSS v3
—
CVSS v2
6.4
VIR risk
6.4
Description
TYPO3 Open redirect vulnerability in the Access tracking mechanism
Predictions
Exploit likelihood
30%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: secalert@redhat.com — http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/
Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/52638
Vendor advisory: secalert@redhat.com — http://secunia.com/advisories/52433
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Packagist | typo3/cms-core | >=4.5.0,<4.5.24 | 4.5.24 |
| Packagist | typo3/cms-core | >=4.6.0,<4.6.17 | 4.6.17 |
| Packagist | typo3/cms-core | >=4.7.0,<4.7.9 | 4.7.9 |
| Packagist | typo3/cms-core | >=6.0.0,<6.0.3 | 6.0.3 |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| typo3 | typo3 | 4.5 | |
| typo3 | typo3 | 4.5.0 | |
| typo3 | typo3 | 4.5.1 | |
| typo3 | typo3 | 4.5.2 | |
| typo3 | typo3 | 4.5.3 | |
| typo3 | typo3 | 4.5.4 | |
| typo3 | typo3 | 4.5.5 | |
| typo3 | typo3 | 4.5.6 | |
| typo3 | typo3 | 4.5.7 | |
| typo3 | typo3 | 4.5.8 | |
| typo3 | typo3 | 4.5.9 | |
| typo3 | typo3 | 4.5.10 | |
| typo3 | typo3 | 4.5.11 | |
| typo3 | typo3 | 4.5.12 | |
| typo3 | typo3 | 4.5.13 | |
| typo3 | typo3 | 4.5.14 | |
| typo3 | typo3 | 4.5.15 | |
| typo3 | typo3 | 4.5.16 | |
| typo3 | typo3 | 4.5.17 | |
| typo3 | typo3 | 4.5.18 | |
| typo3 | typo3 | 4.5.19 | |
| typo3 | typo3 | 4.5.22 | |
| typo3 | typo3 | 4.5.23 | |
| typo3 | typo3 | 4.6 | |
| typo3 | typo3 | 4.6.0 | |
| typo3 | typo3 | 4.6.1 | |
| typo3 | typo3 | 4.6.2 | |
| typo3 | typo3 | 4.6.3 | |
| typo3 | typo3 | 4.6.4 | |
| typo3 | typo3 | 4.6.5 | |
| typo3 | typo3 | 4.6.6 | |
| typo3 | typo3 | 4.6.7 | |
| typo3 | typo3 | 4.6.8 | |
| typo3 | typo3 | 4.6.9 | |
| typo3 | typo3 | 4.6.10 | |
| typo3 | typo3 | 4.6.11 | |
| typo3 | typo3 | 4.6.12 | |
| typo3 | typo3 | 4.6.13 | |
| typo3 | typo3 | 4.6.14 | |
| typo3 | typo3 | 4.6.15 | |
| typo3 | typo3 | 4.6.16 | |
| typo3 | typo3 | 4.7 | |
| typo3 | typo3 | 4.7.0 | |
| typo3 | typo3 | 4.7.1 | |
| typo3 | typo3 | 4.7.2 | |
| typo3 | typo3 | 4.7.3 | |
| typo3 | typo3 | 4.7.4 | |
| typo3 | typo3 | 4.7.5 | |
| typo3 | typo3 | 4.7.6 | |
| typo3 | typo3 | 4.7.7 | |
| typo3 | typo3 | 4.7.8 | |
| typo3 | typo3 | 6.0 | |
| typo3 | typo3 | 6.0.1 | |
| typo3 | typo3 | 6.0.2 | |
References
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00079.html
- http://secunia.com/advisories/52433
- http://secunia.com/advisories/52638
- http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/
- http://www.debian.org/security/2013/dsa-2646
- http://www.openwall.com/lists/oss-security/2013/03/12/3
- http://www.osvdb.org/90924
- http://www.securityfocus.com/bid/58330
- https://nvd.nist.gov/vuln/detail/CVE-2013-1843
- https://github.com/TYPO3-CMS/core
- http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core
CWEs
CWE-399
Verify integrity in audit chain (admin only). AS-IS.